Email when someone ssh's into a server

by Andrew Stilliard

Save the following file to /etc/profile.d/ssh-alerts.sh on your server.

Update your@email.here with your email.

# email on ssh login
if [ -n "$SSH_CLIENT" ]; then  
    TEXT="$(date): ssh login to ${USER}@$(hostname -f)"
    TEXT="$TEXT from $(echo $SSH_CLIENT | awk '{print $1}')"
    echo $TEXT | mail -s "ssh login" your@email.here
fi

Now on yours, and any other user ssh, you'll get an email (assuming you have email setup already with mailutils etc)

The email will look like this, showing the user, which server and their IP (where I've changed the IP to 1.2.3.4 and hostname of the server to my-server-name for the purposes of this screenshot):